ClawHub
Back to skill

Security audit

Qq

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent QQ development guide with purpose-aligned API examples, but users should harden the sample credential handling and logging before production use.

Install only if you are building QQ integrations and treat the snippets as skeleton examples. Before production use, redact logs, avoid full event-payload printing, protect AppSecret and access tokens, prefer least-privilege intents, and follow the current official QQ documentation for required OAuth parameter handling.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:353
Finding

Sensitive credentials and OAuth tokens exposed in URL query strings

Content
View full analysis
dict: url = ( "https://graph.qq.com/oauth2.0/token" f"?grant_type=authorization_code&client_id={APP_ID}" f"&client_secret={APP_SECRET}&code={code}&redirect_uri={REDIRECT_URI}" "&fmt=json" ) return requests.get(url).json() # {"access_token": "...", "expires_in": 7776000, "refresh_token": "..."} # Obtain openid def get_openid(access_token: str) -> str: url = f"https://graph.qq.com/oauth2.0/me?access_token={access_token}&fmt=json" data = requests.get(url).json() return data["openid"] # Obtain user information def get_user_info(access_token: str, openid: str) -> dict: url = ( "https://graph.qq.com/user/get_user_info" f"?access_token={access_token}&oauth_consumer_key={APP_ID}&openid={openid}" ) return requests.get(url).json() ``` ### Technical Analysis The examples place an application secret, OAuth authorization code, and access tokens directly in URL query strings. Although the destinations are legitimate QQ HTTPS endpoints and these requests support the Skill's declared authentication functionality, query parameters are commonly recorded as part of the complete URL. Sensitive values may consequently appear in: - Application and reverse-proxy access logs - HTTP client debug logs - APM and distributed-tracing systems - Exception messag ...[truncated 1608 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:134
Finding

Unredacted QQ event payloads written to application logs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
"appId": app_id,
        "clientSecret": app_secret
    }
    resp = requests.post(url, json=payload)
    data = resp.json()
    # access_token 有效期通常为 7200 秒
    return data["access_token"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
async def send_channel_message(channel_id: str, content: str, token: str,
                                msg_id: str = None, image: str = None):
    """向频道子频道发送消息"""
    url = f"https://api.sgroup.qq.com/channels/{channel_id}/messages"
    headers = {
        "Authorization": f"QQBot {token}",
        "Content-Type": "application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md
async def send_channel_message(channel_id: str, content: str, token: str,
                                msg_id: str = None, image: str = None):
    """向频道子频道发送消息"""
    url = f"https://api.sgroup.qq.com/channels/{channel_id}/messages"
    headers = {
        "Authorization": f"QQBot {token}",
        "Content-Type": "application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md
async def send_channel_message(channel_id: str, content: str, token: str,
                                msg_id: str = None, image: str = None):
    """向频道子频道发送消息"""
    url = f"https://api.sgroup.qq.com/channels/{channel_id}/messages"
    headers = {
        "Authorization": f"QQBot {token}",
        "Content-Type": "application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
async def send_channel_message(channel_id: str, content: str, token: str,
                                msg_id: str = None, image: str = None):
    """向频道子频道发送消息"""
    url = f"https://api.sgroup.qq.com/channels/{channel_id}/messages"
    headers = {
        "Authorization": f"QQBot {token}",
        "Content-Type": "application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md
async def send_channel_message(channel_id: str, content: str, token: str,
                                msg_id: str = None, image: str = None):
    """向频道子频道发送消息"""
    url = f"https://api.sgroup.qq.com/channels/{channel_id}/messages"
    headers = {
        "Authorization": f"QQBot {token}",
        "Content-Type": "application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.

md
# 后端：code 换取 session
def qq_miniapp_login(code):
    url = (
        'https://api.q.qq.com/sns/jscode2session'
        f'?appid={QQ_APPID}&secret={QQ_SECRET}&js_code={code}'
        '&grant_type=authorization_code'
    )

Static analysis

No suspicious patterns detected.